A deep walk through what the page cache really is. struct page, address_space, the read and write paths, the physmap, eviction, the tools to inspect it, and why kernel bugs that touch it tend to be catastrophic.
A byte-level walk through CVE-2026-31431. What the 2017 commit actually changed, why splice() turned the page cache into a writable primitive, an annotated read of the 732-byte PoC, and the container escape angle the original disclosure skipped.